1. Field of the Invention
The present invention is directed toward the field of electronic commerce (“e-commerce”), and more particularly toward generating an open digital signature for use in e-commerce.
2. Art Background
Electronic commerce, known as “e-commerce”, has become increasingly more popular with the proliferation of the Internet. In general, e-commerce involves electronic transactions between two or more parties. For example, an e-commerce transaction may be between a consumer and an on-line merchant, or an e-commerce transaction may be implemented for procurement between a company and its vendor. Regardless of the nature of the transaction, in order to promote the use of e-commerce, there is a demand for secure transactions among the parties. A secure transaction involves both the ability to verify that information, transmitted as part of the transaction, has not been altered, as well as the ability to authenticate the parties themselves. In order to provide secure transactions for use in e-commerce, digital signatures have been used.
In general, a digital signature is an encrypted electronic fingerprint. When the encrypted fingerprint is attached to a file or a document, the digital signature signifies that the owner issued the document. This characteristic of digital signatures enables the conduction of e-commerce to occur in a legal and binding manner. The process of generating a digital signature involves the use of both a certificate, particular to each individual or entity, and a signature, that constitutes a unique fingerprint of the document or file. The fingerprint, referred to as message digest, is derived from data in the document or file being signed. The message digest is encrypted for authentication purposes using the signor's private key so that it may only be decrypted with the signor's public key. The public key is contained in the signor's certificate, and is transmitted to the recipient of the document.
In order to make the message digest legal and binding, a Certification Authority, such as Digital Signature Trust, Verisign, Entrust, and many others, acts as an independent third party, very much like a notary public. In general, the Certificate Authority issues unique certificates to individuals or entities, and, during the process of verification of a digital signature, provides the means to verify and certify that the electronic fingerprint belongs to the certificate holder.
Digital signatures use, as a security mechanism, public key cryptography. In general, with public key cryptography, the signor of a document receives a private key and public key pair. The fingerprint is encrypted with the private key, and the public key is sent to the recipient of the document to decrypt the digital signature. The private key portion of the security key pair is similar to the PIN code of your credit card. Currently, the Certification Authority issues a Certificate, using Industry Standard Organization (“ISO”) X.509 standard, that encapsulates the public key portion of the private-public key pair.
Although digital signatures provide a way to authenticate documents, in practice, current software products that generate digital signatures do not permit an effective way to store, retrieve, and manipulate documents in a manner that is useful to users. The following scenario illustrates the inability to effectively use digital signatures. Suppose that John Public had a document containing very sensitive legal information regarding a contractual agreement he wished to make with ACME Company. John does not have the time to come to the ACME office with the document, so he uses his email client to digitally sign and send the document to ACME. The next morning Jane Doe, an employee at ACME, reads her email that contains John's document. She notes that the document is digitally signed and confirms that the document is from John and has not been altered from its original form. However, Jane Doe now must store the document in her database to subsequently obtain proper approval from her supervisor regarding the terms of John Public's contract. Here is where the problems begin to a rise. The approval person at ACME has no way of knowing that the document has not changed since Jane stored it in the company database. This example shows how the usefulness of the digital signature disappears once the document leaves the email client.
Accordingly, it is desirable to provide a means to generate digital signatures that are not specific to an application, such as an email client. The digital signature service also provides the functionality to obtain certificates, manage private—public keys, and generate digital signatures for documents that may be stored independent of other tools used by the user.